Cisco IOS NetFlow Version 9 Flow-Record Format
|
|
- Dale Wilson
- 8 years ago
- Views:
Transcription
1 Cisco IOS NetFlow Version 9 Flow-Record Format Last updated: February 007 Overview Cisco IOS NetFlow services provide network administrators with access to information concerning IP flows within their data networks Exported NetFlow data can be used for a variety of purposes, including network management and planning, enterprise accounting, and departmental chargebacks, Internet Service ppovider (ISP) billing, data warehousing, combating Denial of Service (DoS) attacks, and data mining for marketing purposes The basic output of NetFlow is a flow record Several different formats for flow records have evolved as NetFlow has matured The most recent evolution of the NetFlow flow-record format is known as Version 9 The distinguishing feature of the NetFlow Version 9 format is that it is template based Templates provide an extensible design to the record format, a feature that should allow future enhancements to NetFlow services without requiring concurrent changes to the basic flow-record format Using templates provides several key benefits: Third-party business partners who produce applications that provide collector or display services for NetFlow will not be required to recompile their applications each time a new NetFlow feature is added; instead, they may be able to use an external data file that documents the known template formats New features can be added to NetFlow more quickly, without breaking current implementations NetFlow is future-proofed against new or developing protocols, because the Version 9 format can be adapted to provide support for them Terminology Used in This Document One of the difficulties in describing the NetFlow Version 9 packet format occurs because many distinctly different, but similar-sounding, terms are used to describe portions of the NetFlow output To eliminate any confusion, these terms are described below: Export packet Built by a device (for example, a router) with NetFlow services enabled, this type of packet is addressed to another device (for example, a NetFlow collector) This other device processes the packet (parses, aggregates, and stores information on IP flows) Packet header the first part of an export packet, the packet header provides basic information about the packet, such as the NetFlow version, number of records contained within the packet, and sequence numbering, enabling lost packets to be detected FlowSet following the packet header, an export packet contains information that must be parsed and interpreted by the collector device A FlowSet is a generic term for a collection of records that follow the packet header in an export packet There are two different types of FlowSets: template and data An export packet contains one or more FlowSets, and both template and data FlowSets can be mixed within the same export packet All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page of 3
2 Template FlowSet a template FlowSet is a collection of one or more template records that have been grouped together in an export packet Template record a template record is used to define the format of subsequent data records that may be received in current or future export packets It is important to note that a template record within an export packet does not necessarily indicate the format of data records within that same packet A collector application must cache any template records received, and then parse any data records it encounters by locating the appropriate template record within the cache Template ID the template ID is a unique number that distinguishes this template record from all other template records produced by the same export device A collector application that is receiving export packets from several devices should be aware that uniqueness is not guaranteed across export devices Thus, the collector should also cache the address of the export device that produced the template ID in order to enforce uniqueness Data FlowSet a data FlowSet is a collection of one or more data records that have been grouped together in an export packet Data record A data record provides information about an IP flow that exists on the device that produced an export packet Each group of data records (that is, each data FlowSet) references a previously transmitted template ID, which can be used to parse the data contained within the records Options template an options template is a special type of template record used to communicate the format of data related to the NetFlow process Options data record the options data record is a special type of data record (based on an options template) with a reserved template ID that provides information about the NetFlow process itself NetFlow Version 9 Packet Layout The NetFlow Version 9 record format consists of a packet header followed by at least one or more template or data FlowSets A template FlowSet provides a description of the fields that will be present in future data FlowSets These data FlowSets may occur later within the same export packet or in subsequent export packets Template and data FlowSets can be intermingled within a single export packet, as illustrated in Table Table NetFlow Version 9 Export Packet Packet Header Template FlowSet Data FlowSet Data FlowSet Template FlowSet Data FlowSet The possible combinations that can occur in an export packet follow: An export packet that consists of interleaved template and data FlowSets A collector device should not assume that the template IDs defined in such a packet have any specific relationship to the data FlowSets within the same packet The collector must always cache any received templates, and examine the template cache to determine the appropriate template ID to interpret a data record An export packet consisting entirely of data FlowSets after the appropriate template IDs have been defined and transmitted to the collector device, most of the export packets will consist solely of data FlowSets All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page of 3
3 An export packet consisting entirely of template FlowSets although this case is the exception, it is possible to receive packets containing only template records Ordinarily, templates are piggybacked onto data FlowSets However, in some instances only templates are sent When a router first boots up or reboots, it attempts to synchronize with the collector device as quickly as possible The router may send template FlowSets at an accelerated rate so that the collector device has sufficient information to interpret any subsequent data FlowSets Also, template records have a limited lifetime, and they must be periodically refreshed If the refresh interval for a template occurs and there is no appropriate data FlowSet that needs to be sent to the collector device, an export packet consisting solely of template FlowSets is sent The format of both template and data FlowSets is discussed later in this document NetFlow Version 9 Packet Header Format The format of the NetFlow Version 9 packet header remains relatively unchanged from previous versions It is based on the NetFlow Version 5 packet header and is illustrated in Table Table 3 gives field descriptions Table NetFlow Version 9 Packet Header Format Version Count System Uptime UNIX Seconds Package Sequence Source ID Table 3 Field Name Version Count NetFlow Version 9 Packet Header Field Descriptions Value The version of NetFlow records exported in this packet; for Version 9, this value is 0x0009 Number of FlowSet records (both template and data) contained within this packet System Uptime Time in milliseconds since this device was first booted UNIX Seconds Seconds since 0000 Coordinated Universal Time (UTC) 970 Sequence Number Source ID Incremental sequence counter of all export packets sent by this export device; this value is cumulative, and it can be used to identify whether any export packets have been missed Note: This is a change from the NetFlow Version 5 and Version 8 headers, where this number represented total flows The Source ID field is a 3-bit value that is used to guarantee uniqueness for all flows exported from a particular device (The Source ID field is the equivalent of the engine type and engine ID fields found in the NetFlow Version 5 and Version 8 headers) The format of this field is vendor specific In the Cisco implementation, the first two bytes are reserved for future expansion, and will always be zero Byte 3 provides uniqueness with respect to the routing engine on the exporting device Byte 4 provides uniqueness with respect to the particular line card or Versatile Interface Processor on the exporting device Collector devices should use the combination of the source IP address plus the Source ID field to associate an incoming NetFlow export packet with a unique instance of NetFlow on a particular device Other values that existed in the NetFlow Version 5 and Version 8 packet headers (such as sampling interval and aggregation scheme) are sent in a reserved options data record The format of the options template and options data record is discussed later in this document All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 3 of 3
4 NetFlow Version 9 Template FlowSet Format One of the key elements in the new NetFlow Version 9 format is the template FlowSet Templates greatly enhance the flexibility of the NetFlow record format, because they allow a NetFlow collector or display application to process NetFlow data without necessarily knowing the format of the data in advance Templates are used to describe the type and length of individual fields within a NetFlow data record that match a template ID The format of the template FlowSet is described in Table 4, and the field descriptions are given in Table 5 Table 4 NetFlow Version 9 Template FlowSet Format FlowSet ID = 0 Length Template ID Field Count Field Type Field Length Field Type Field Length Field N Type Field N Length Template ID Field Count Field Type Field Length Field Type Field Length Field N Type Field N Length All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 4 of 3
5 Table 5 Field Name FlowSet ID Length Template ID Field Count Field Type Field Length NetFlow Version 9 Template FlowSet Field Descriptions Value The FlowSet ID is used to distinguish template records from data records A template record always has a FlowSet ID in the range of 0-55 Currently, the template record that describes flow fields has a FlowSet ID of zero and the template record that describes option fields (described below) has a FlowSet ID of A data record always has a nonzero FlowSet ID greater than 55 Length refers to the total length of this FlowSet Because an individual template FlowSet may contain multiple template IDs (as illustrated above), the length value should be used to determine the position of the next FlowSet record, which could be either a template or a data FlowSet Length is expressed in Type/Length/Value (TLV) format, meaning that the value includes the bytes used for the FlowSet ID and the length bytes themselves, as well as the combined lengths of all template records included in this FlowSet As a router generates different template FlowSets to match the type of NetFlow data it will be exporting, each template is given a unique ID This uniqueness is local to the router that generated the template ID Templates that define data record formats begin numbering at 56 since 0-55 are reserved for FlowSet IDs This field gives the number of fields in this template record Because a template FlowSet may contain multiple template records, this field allows the parser to determine the end of the current template record and the start of the next This numeric value represents the type of the field The possible values of the field type are vendor specific Cisco supplied values are consistent across all platforms that support NetFlow Version 9 At the time of the initial release of the NetFlow Version 9 code (and after any subsequent changes that could add new field-type definitions), Cisco provides a file that defines the known field types and their lengths The currently defined field types are detailed in Table 6 This number gives the length of the above-defined field, in bytes Note the following: Template IDs are not consistent across a router reboot Template IDs should change only if the configuration of NetFlow on the export device changes Templates periodically expire if they are not refreshed Templates can be refreshed in two ways A template can be resent every N number of export packets A template can also be sent on a timer, so that it is refreshed every N number of minutes Both options are user configurable Table 6 NetFlow Version 9 Field Type Definitions Field Type Value Length (bytes) Description IN_BYTES N (default is 4) Incoming counter with length N x 8 bits for number of bytes associated with an IP Flow IN_PKTS N (default is 4) Incoming counter with length N x 8 bits for the number of packets associated with an IP Flow FLOWS 3 N Number of flows that were aggregated; default for N is 4 PROTOCOL 4 IP protocol byte SRC_TOS 5 Type of Service byte setting when entering incoming interface TCP_FLAGS 6 Cumulative of all the TCP flags seen for this flow L4_SRC_PORT 7 TCP/UDP source port number ie : FTP, Telnet, or equivalent IPV4_SRC_ADDR 8 4 IPv4 source address SRC_MASK 9 The number of contiguous bits in the source address subnet mask ie: the submask in slash notation INPUT_SNMP 0 N Input interface index; default for N is but higher values could be used L4_DST_PORT TCP/UDP destination port number ie: FTP, Telnet, or equivalent IPV4_DST_ADDR 4 IPv4 destination address All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 5 of 3
6 Field Type Value Length (bytes) Description DST_MASK 3 The number of contiguous bits in the destination address subnet mask ie: the submask in slash notation OUTPUT_SNMP 4 N Output interface index; default for N is but higher values could be used IPV4_NEXT_HOP 5 4 IPv4 address of next-hop router SRC_AS 6 N (default is ) Source BGP autonomous system number where N could be or 4 DST_AS 7 N (default is ) Destination BGP autonomous system number where N could be or 4 BGP_IPV4_NEXT_HOP 8 4 Next-hop router's IP in the BGP domain MUL_DST_PKTS 9 N (default is 4) IP multicast outgoing packet counter with length N x 8 bits for packets associated with the IP Flow MUL_DST_BYTES 0 N (default is 4) IP multicast outgoing byte counter with length N x 8 bits for bytes associated with the IP Flow LAST_SWITCHED 4 System uptime at which the last packet of this flow was switched FIRST_SWITCHED 4 System uptime at which the first packet of this flow was switched OUT_BYTES 3 N (default is 4) Outgoing counter with length N x 8 bits for the number of bytes associated with an IP Flow OUT_PKTS 4 N (default is 4) Outgoing counter with length N x 8 bits for the number of packets associated with an IP Flow MIN_PKT_LNGTH 5 Minimum IP packet length on incoming packets of the flow MAX_PKT_LNGTH 6 Maximum IP packet length on incoming packets of the flow IPV6_SRC_ADDR 7 6 IPv6 Source Address IPV6_DST_ADDR 8 6 IPv6 Destination Address IPV6_SRC_MASK 9 Length of the IPv6 source mask in contiguous bits IPV6_DST_MASK 30 Length of the IPv6 destination mask in contiguous bits IPV6_FLOW_LABEL 3 3 IPv6 flow label as per RFC 460 definition ICMP_TYPE 3 Internet Control Message Protocol (ICMP) packet type; reported as ((ICMP Type*56) + ICMP code) MUL_IGMP_TYPE 33 Internet Group Management Protocol (IGMP) packet type SAMPLING_INTERVAL 34 4 When using sampled NetFlow, the rate at which packets are sampled ie: a value of 00 indicates that one of every 00 packets is sampled SAMPLING_ALGORITHM 35 The type of algorithm used for sampled NetFlow: 0x0 Deterministic Sampling,0x0 Random Sampling FLOW_ACTIVE_TIMEOUT 36 Timeout value (in seconds) for active flow entries in the NetFlow cache FLOW_INACTIVE_TIMEOUT 37 Timeout value (in seconds) for inactive flow entries in the NetFlow cache ENGINE_TYPE 38 Type of flow switching engine: RP = 0, VIP/Linecard = ENGINE_ID 39 ID number of the flow switching engine TOTAL_BYTES_EXP 40 N (default is 4) Counter with length N x 8 bits for bytes for the number of bytes exported by the Observation Domain TOTAL_PKTS_EXP 4 N (default is 4) Counter with length N x 8 bits for bytes for the number of packets exported by the Observation Domain TOTAL_FLOWS_EXP 4 N (default is 4) Counter with length N x 8 bits for bytes for the number of flows exported by the Observation Domain *Vendor Proprietary* 43 IPV4_SRC_PREFIX 44 4 IPv4 source address prefix (specific for Catalyst architecture) IPV4_DST_PREFIX 45 4 IPv4 destination address prefix (specific for Catalyst architecture) All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 6 of 3
7 Field Type Value Length (bytes) Description MPLS_TOP_LABEL_TYPE 46 MPLS Top Label Type: 0x00 UNKNOWN 0x0 TE-MIDPT 0x0 ATOM 0x03 VPN 0x04 BGP 0x05 LDP MPLS_TOP_LABEL_IP_ADDR 47 4 Forwarding Equivalent Class corresponding to the MPLS Top Label FLOW_SAMPLER_ID 48 Identifier shown in show flow-sampler FLOW_SAMPLER_MODE 49 The type of algorithm used for sampling data: 0x0 random sampling Use in connection with FLOW_SAMPLER_MODE FLOW_SAMPLER_RANDOM_I NTERVAL 50 4 Packet interval at which to sample Use in connection with FLOW_SAMPLER_MODE *Vendor Proprietary* 5 MIN_TTL 5 Minimum TTL on incoming packets of the flow MAX_TTL 53 Maximum TTL on incoming packets of the flow IPV4_IDENT 54 The IP v4 identification field DST_TOS 55 Type of Service byte setting when exiting outgoing interface IN_SRC_MAC 56 6 Incoming source MAC address OUT_DST_MAC 57 6 Outgoing destination MAC address SRC_VLAN 58 Virtual LAN identifier associated with ingress interface DST_VLAN 59 Virtual LAN identifier associated with egress interface IP_PROTOCOL_VERSION 60 Internet Protocol Version Set to 4 for IPv4, set to 6 for IPv6 If not present in the template, then version 4 is assumed DIRECTION 6 Flow direction: 0 - ingress flow, - egress flow IPV6_NEXT_HOP 6 6 IPv6 address of the next-hop router BPG_IPV6_NEXT_HOP 63 6 Next-hop router in the BGP domain IPV6_OPTION_HEADERS 64 4 Bit-encoded field identifying IPv6 option headers found in the flow *Vendor Proprietary* 65 *Vendor Proprietary* 66 *Vendor Proprietary* 67 *Vendor Proprietary* 68 *Vendor Proprietary* 69 MPLS_LABEL_ 70 3 MPLS label at position in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ 7 3 MPLS label at position in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_3 7 3 MPLS label at position 3 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ MPLS label at position 4 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ MPLS label at position 5 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ MPLS label at position 6 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ MPLS label at position 7 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ MPLS label at position 8 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 7 of 3
8 Field Type Value Length (bytes) Description MPLS_LABEL_ MPLS label at position 9 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (end-ofstack) bit MPLS_LABEL_ MPLS label at position 0 in the stack This comprises 0 bits of MPLS label, 3 EXP (experimental) bits and S (endof-stack) bit IN_DST_MAC 80 6 Incoming destination MAC address OUT_SRC_MAC 8 6 Outgoing source MAC address IF_NAME 8 N (default specified in template) Shortened interface name ie: FE/0 IF_DESC 83 N (default specified in template) SAMPLER_NAME 84 N (default specified in template) Full interface name ie: 'FastEthernet /0 Name of the flow sampler IN_ PERMANENT _BYTES 85 N (default is 4) Running byte counter for a permanent flow IN_ PERMANENT _PKTS 86 N (default is 4) Running packet counter for a permanent flow * Vendor Proprietary* 87 FRAGMENT_OFFSET 88 The fragment-offset value from fragmented IP packets All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 8 of 3
9 Field Type Value Length (bytes) Description FORWARDING STATUS 89 Forwarding status is encoded on byte with the left bits giving the status and the 6 remaining bits giving the reason code Status is either unknown (00), Forwarded (0), Dropped (0) or Consumed () Below is the list of forwarding status values with their means Unknown 0 Forwarded Unknown 64 Forwarded Fragmented 65 Forwarded not Fragmented 66 Dropped Unknown 8, Drop ACL Deny 9, Drop ACL drop 30, Drop Unroutable 3, Drop Adjacency 3, Drop Fragmentation & DF set 33, Drop Bad header checksum 34, Drop Bad total Length 35, Drop Bad Header Length 36, Drop bad TTL 37, Drop Policer 38, Drop WRED 39, Drop RPF 40, Drop For us 4, Drop Bad output interface 4, Drop Hardware 43, Consumed Unknown 9, Terminate Punt Adjacency 93, Terminate Incomplete Adjacency 94, Terminate For us 95 When extensibility is required, the new field types will be added to the list The new field types have to be updated on the Exporter and Collector but the NetFlow export format would remain unchanged In some cases the size of a field type is fixed by definition, for example PROTOCOL, or IPV4_SRC_ADDR However in other cases they are defined as a variant type This improves the memory efficiency in the collector and reduces the network bandwidth requirement between the Exporter and the Collector As an example, in the case IN_BYTES, on an access router it might be sufficient to use a 3 bit counter (N = 4), on a core router a 64 bit counter (N = 8) would be required All counters and counter-like objects are unsigned integers of size N * 8 bits All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 9 of 3
10 NetFlow Version 9 Data FlowSet Format The format of the data FlowSet is described in Table 7, and the field descriptions are given in Table 8 Table 7 NetFlow Version 9 Data FlowSet Format FlowSet ID = Template ID Length Record - Field value Record - Field value Record - Field 3 value Record - Field 4 value Record - Field N value Record - Field value Record - Field value Record - Field 3 value Record - Field N value Padding All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 0 of 3
11 Table 8 Field Name NetFlow Version 9 Data FlowSet Field Descriptions Value FlowSet ID = Template ID Length Record N Field N Padding A FlowSet ID precedes each group of records within a NetFlow Version 9 data FlowSet The FlowSet ID maps to a (previously received) template ID The collector and display applications should use the FlowSet ID to map the appropriate type and length to any field values that follow This field gives the length of the data FlowSet Length is expressed in TLV format, meaning that the value includes the bytes used for the FlowSet ID and the length bytes themselves, as well as the combined lengths of any included data records The remainder of the Version 9 data FlowSet is a collection of field values The type and length of the fields have been previously defined in the template record referenced by the FlowSet ID/template ID Padding should be inserted to align the end of the FlowSet on a 3 bit boundary Pay attention that the Length field will include those padding bits When interpreting the NetFlow Version 9 data FlowSet format, note that the fields cannot be parsed without a corresponding template ID If a data FlowSet that does not have an appropriate template ID is received, the record should be discarded NetFlow Version 9 Options Template Format One additional record type is very important within the NetFlow Version 9 specification: an options template (and its corresponding options data record) Rather than supplying information about IP flows, options are used to supply meta-data about the NetFlow process itself The format of the options template is detailed in Table 9, and field descriptions are given in Table 0 Table 9 NetFlow Version 9 Options Template FlowSet ID = Length Template ID Option Scope Length Option Length Scope Field Type Scope Field Length Scope Field N Length Option Field Type Option Field Length Option Field N Length Padding All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page of 3
12 Table 0 Field Name NetFlow Version 9 Options Template Field Definitions Value FlowSet ID = Length Template ID Option Scope Length Options Length Scope Field Type Scope Field Length Option Field Type Option Field Length Padding The FlowSet ID is used to distinguish template records from data records A template record always has a FlowSet ID of A data record always has a nonzero FlowSet ID which is greater than 55 This field gives the total length of this FlowSet Because an individual template FlowSet may contain multiple template IDs, the length value should be used to determine the position of the next FlowSet record, which could be either a template or a data FlowSet Length is expressed in TLV format, meaning that the value includes the bytes used for the FlowSet ID and the length bytes themselves, as well as the combined lengths of all template records included in this FlowSet As a router generates different template FlowSets to match the type of NetFlow data it will be exporting, each template is given a unique ID This uniqueness is local to the router that generated the template ID The Template ID is greater than 55 Template IDs inferior to 55 are reserved This field gives the length in bytes of any scope fields contained in this options template (the use of scope is described below) This field gives the length (in bytes) of any Options field definitions contained in this options template This field gives the relevant portion of the NetFlow process to which the options record refers Currently defined values follow: 0x000 System 0x000 Interface 0x0003 Line Card 0x0004 NetFlow Cache 0x0005 Template For example, sampled NetFlow can be implemented on a per-interface basis, so if the options record was reporting on how sampling is configured, the scope for the report would be 0x000 (interface) This field gives the length (in bytes) of the Scope field, as it would appear in an options record This numeric value represents the type of the field that appears in the options record Possible values are detailed in Table 6 above This number is the length (in bytes) of the field, as it would appear in an options record Padding should be inserted to align the end of the FlowSet on a 3 bit boundary Pay attention that the Length field will include those padding bits Examples Example Figure shows an example of the options template Figure Options Template Example Example All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page of 3
13 In this example, we are reporting the following 3 Flow records: Src IP addr Dst IP addr Next Hop addr Packet Bytes Number Number Figure diagrams the NetFlow Version 9 export packet Note the following: Export packets can be composed of both template and data FlowSets Template and data FlowSets can be interleaved The template ID in the template record maps to the FlowSet ID in a corresponding data FlowSet The layout of the data in the data record maps to the fields formats defined in the template record Although in this example the template FlowSet that defines template ID 56 happens to be followed by data FlowSets that reference template ID 56, this setup is for illustration purposes only Data records are not necessarily preceded by their corresponding template within an export packet Figure NetFlow Version 9 Export Packet Example All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 3 of 3
14 The Collector or Mediation Device The Collector will receive template definitions from the Exporter, normally before receiving Flow Records The Flow Records can then be decoded and stored locally on the devices In case the template definitions have not been received at the time a Flow Record is received, the Collector should keep the Flow Record for later decode once the template definitions are received A Collector device must not assume that the Data FlowSet and the associated Template IDs are exported in the same Export Packet The Collector must not assume that one and only one Template FlowSet is present in an Export Packet; in rare circumstances, the Export Packet may contain several Template FlowSets Templates live only for a certain timeframe The lifetime of a Template should be deducted on the Collector based upon the time where the last Template FlowSet was received from the Exporter The collector must not attempt to decode the Flow Records with an expired Template The Collector should maintain a similar list: <Exporter, Export Interface, Template ID, Template ID, Template Def, Last Received> If a new Template definition is received (for example in case of an Exporter restart) it should immediately override the existing definition Printed in USA C /07 All contents are Copyright Cisco Systems, Inc All rights reserved This document is Cisco Public Information Page 4 of 3
Cisco IOS NetFlow Version 9 Flow-Record Format
White Paper Cisco IOS NetFlow Version 9 Flow-Record Format Last updated: May 0 Overview Cisco IOS NetFlow services provide network administrators with access to information concerning IP flows within their
More informationLogLogic Cisco NetFlow Log Configuration Guide
LogLogic Cisco NetFlow Log Configuration Guide Document Release: March 2012 Part Number: LL600068-00ELS090000 This manual supports LogLogic Cisco NetFlow Version 2.0, and LogLogic Software Release 5.1
More informationNetFlow v9 Export Format
NetFlow v9 Export Format With this release, NetFlow can export data in NetFlow v9 (version 9) export format. This format is flexible and extensible, which provides the versatility needed to support new
More informationAppendix A Remote Network Monitoring
Appendix A Remote Network Monitoring This appendix describes the remote monitoring features available on HP products: Remote Monitoring (RMON) statistics All HP products support RMON statistics on the
More informationIntroduction to Cisco IOS Flexible NetFlow
Introduction to Cisco IOS Flexible NetFlow Last updated: September 2008 The next-generation in flow technology allowing optimization of the network infrastructure, reducing operation costs, improving capacity
More informationConfiguring SNMP and using the NetFlow MIB to Monitor NetFlow Data
Configuring SNMP and using the NetFlow MIB to Monitor NetFlow Data NetFlow is a technology that provides highly granular per-flow statistics on traffic in a Cisco router. The NetFlow MIB feature provides
More informationConfiguring Flexible NetFlow
CHAPTER 62 Note Flexible NetFlow is only supported on Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X. Flow is defined as a unique set of key fields attributes, which might include fields
More informationNetFlow Aggregation. Feature Overview. Aggregation Cache Schemes
NetFlow Aggregation This document describes the Cisco IOS NetFlow Aggregation feature, which allows Cisco NetFlow users to summarize NetFlow export data on an IOS router before the data is exported to
More informationIPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令
IPV6 流 量 分 析 探 讨 北 京 大 学 计 算 中 心 周 昌 令 1 内 容 流 量 分 析 简 介 IPv6 下 的 新 问 题 和 挑 战 协 议 格 式 变 更 用 户 行 为 特 征 变 更 安 全 问 题 演 化 流 量 导 出 手 段 变 化 设 备 参 考 配 置 流 量 工 具 总 结 2 流 量 分 析 简 介 流 量 分 析 目 标 who, what, where,
More informationNetFlow/IPFIX Various Thoughts
NetFlow/IPFIX Various Thoughts Paul Aitken & Benoit Claise 3 rd NMRG Workshop on NetFlow/IPFIX Usage in Network Management, July 2010 1 B #1 Application Visibility Business Case NetFlow (L3/L4) DPI Application
More informationCisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
More information- Multiprotocol Label Switching -
1 - Multiprotocol Label Switching - Multiprotocol Label Switching Multiprotocol Label Switching (MPLS) is a Layer-2 switching technology. MPLS-enabled routers apply numerical labels to packets, and can
More informationUltraFlow -Cisco Netflow tools-
UltraFlow UltraFlow is an application for collecting and analysing Cisco Netflow data. It is written in Python, wxpython, Matplotlib, SQLite and the Python based Twisted network programming framework.
More informationConfiguring NetFlow Data Export (NDE)
49 CHAPTER Prerequisites for NDE, page 49-1 Restrictions for NDE, page 49-1 Information about NDE, page 49-2 Default Settings for NDE, page 49-11 How to Configure NDE, page 49-11 Note For complete syntax
More informationSonicOS 5.8: NetFlow Reporting
SonicOS 5.8: NetFlow Reporting Document Scope Rapid growth of IP networks has created interest in new business applications and services. These new services have resulted in increases in demand for network
More informationEMIST Network Traffic Digesting (NTD) Tool Manual (Version I)
EMIST Network Traffic Digesting (NTD) Tool Manual (Version I) J. Wang, D.J. Miller and G. Kesidis CSE & EE Depts, Penn State EMIST NTD Tool Manual (Version I) Page 1 of 7 Table of Contents 1. Overview...
More informationNetStream (Integrated) Technology White Paper HUAWEI TECHNOLOGIES CO., LTD. Issue 01. Date 2012-9-6
(Integrated) Technology White Paper Issue 01 Date 2012-9-6 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means
More informationConfiguring NetFlow-lite
CHAPTER 55 Note NetFlow-lite is only supported on Catalyst 4948E Ethernet Switch. This chapter describes how to configure NetFlow-lite on the Catalyst 4948E switch. NetFlow-lite provides traffic monitoring
More informationJunos OS. Flow Monitoring Feature Guide for Routing Devices. Release 14.1. Published: 2014-09-27. Copyright 2014, Juniper Networks, Inc.
Junos OS Flow Monitoring Feature Guide for Routing Devices Release 14.1 Published: 2014-09-27 Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, California 94089 USA 408-745-2000 www.juniper.net
More informationNetFlow Configuration Guide, Cisco IOS Release 12.4
NetFlow Configuration Guide, Cisco IOS Release 12.4 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)
More informationCisco IOS Flexible NetFlow Command Reference
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More informationIntegrated Traffic Monitoring
61202880L1-29.1F November 2009 Configuration Guide This configuration guide describes integrated traffic monitoring (ITM) and its use on ADTRAN Operating System (AOS) products. Including an overview of
More informationNetFlow Configuration Guide, Cisco IOS Release 15M&T
Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION
More informationNetwork layer: Overview. Network layer functions IP Routing and forwarding
Network layer: Overview Network layer functions IP Routing and forwarding 1 Network layer functions Transport packet from sending to receiving hosts Network layer protocols in every host, router application
More informationNetFlow Configuration Guide, Cisco IOS Release 12.2SR
NetFlow Configuration Guide, Cisco IOS Release 12.2SR Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387)
More informationhttp://www.cisco.com/en/us/products//hw/switches/ps4324/index.html http://www.cisco.com/en/us/products/ps6350/index.html
CHAPTER 54 Supervisor Engine 6-E and Catalyst 4900M chassis do not support Netflow; it is only supported on Supervisor Engine IV, Supervisor Engine V, Supervisor Engine V-10GE, or WS-F4531. This chapter
More informationConfiguring NetFlow on Cisco ASR 9000 Series Aggregation Services Router
Configuring NetFlow on Cisco ASR 9000 Series Aggregation Services Router This module describes the configuration of NetFlow on the Cisco ASR 9000 Series Aggregation Services Router. A NetFlow flow is a
More informationConfiguring NetFlow on Cisco IOS XR Software
Configuring NetFlow on Cisco IOS XR Software A NetFlow flow is a unidirectional sequence of packets that arrive on a single interface ( subinterface), and have the same values f key fields. NetFlow is
More informationEnabling NetFlow on Virtual Switches ESX Server 3.5
Technical Note Enabling NetFlow on Virtual Switches ESX Server 3.5 NetFlow is a general networking tool with multiple uses, including network monitoring and profiling, billing, intrusion detection and
More informationNetflow Overview. PacNOG 6 Nadi, Fiji
Netflow Overview PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools
More informationGetting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export
Getting Started with Configuring Cisco IOS NetFlow and NetFlow Data Export Last Updated: November 28, 2011 This module contains the minimum amount of information about and instructions necessary for configuring
More informationCisco NetFlow TM Briefing Paper. Release 2.2 Monday, 02 August 2004
Cisco NetFlow TM Briefing Paper Release 2.2 Monday, 02 August 2004 Contents EXECUTIVE SUMMARY...3 THE PROBLEM...3 THE TRADITIONAL SOLUTIONS...4 COMPARISON WITH OTHER TECHNIQUES...6 CISCO NETFLOW OVERVIEW...7
More informationConfiguring NetFlow Switching
Configuring NetFlow Switching This chapter describes how to configure NetFlow switching. For a complete description of NetFlow commands used in this chapter, refer to the Cisco IOS Switching s chapter
More informationNetwork Management & Monitoring
Network Management & Monitoring NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
More informationHow Routers Forward Packets
Autumn 2010 philip.heimer@hh.se MULTIPROTOCOL LABEL SWITCHING (MPLS) AND MPLS VPNS How Routers Forward Packets Process switching Hardly ever used today Router lookinginside the packet, at the ipaddress,
More informationCatalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting
Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Document ID: 70974 Introduction Prerequisites Requirements Components Used Conventions Background Information Configure Network Diagram
More informationLab 4.1.2 Characterizing Network Applications
Lab 4.1.2 Characterizing Network Applications Objective Device Designation Device Name Address Subnet Mask Discovery Server Business Services 172.17.1.1 255.255.0.0 R1 FC-CPE-1 Fa0/1 172.17.0.1 Fa0/0 10.0.0.1
More informationConfiguring NetFlow. Information About NetFlow. NetFlow Overview. Send document comments to nexus7k-docfeedback@cisco.com. CHAPTER
CHAPTER 16 This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices. This chapter includes the following sections: Information About NetFlow, page 16-1 Licensing Requirements
More informationNetwork Layer: Network Layer and IP Protocol
1 Network Layer: Network Layer and IP Protocol Required reading: Garcia 7.3.3, 8.1, 8.2.1 CSE 3213, Winter 2010 Instructor: N. Vlajic 2 1. Introduction 2. Router Architecture 3. Network Layer Protocols
More informationConfiguring NetFlow. Information About NetFlow. NetFlow Overview. Send document comments to nexus7k-docfeedback@cisco.com. CHAPTER
CHAPTER 19 This chapter describes how to configure the NetFlow feature on Cisco NX-OS devices. This chapter includes the following sections: Information About NetFlow, page 19-1 Licensing Requirements
More informationNet-flow. PacNOG 6 Nadi, Fiji
Net-flow PacNOG 6 Nadi, Fiji Agenda Netflow What it is and how it works Uses and Applications Vendor Configurations/ Implementation Cisco and Juniper Flow-tools Architectural issues Software, tools etc
More informationCisco IOS Flexible NetFlow Overview
Cisco IOS Flexible NetFlow Overview First Published: June 19th, 2006 Last Updated: June 19th, 2006 NetFlow is a Cisco IOS technology that provides statistics on packets flowing through the router. NetFlow
More informationInternet Protocols Fall 2005. Lectures 7-8 Andreas Terzis
Internet Protocols Fall 2005 Lectures 7-8 Andreas Terzis Outline Internet Protocol Service Model Fragmentation Addressing Original addressing scheme Subnetting CIDR Forwarding ICMP ARP Address Shortage
More informationInternet Protocol: IP packet headers. vendredi 18 octobre 13
Internet Protocol: IP packet headers 1 IPv4 header V L TOS Total Length Identification F Frag TTL Proto Checksum Options Source address Destination address Data (payload) Padding V: Version (IPv4 ; IPv6)
More informationWAN Topologies MPLS. 2006, Cisco Systems, Inc. All rights reserved. Presentation_ID.scr. 2006 Cisco Systems, Inc. All rights reserved.
MPLS WAN Topologies 1 Multiprotocol Label Switching (MPLS) IETF standard, RFC3031 Basic idea was to combine IP routing protocols with a forwarding algoritm based on a header with fixed length label instead
More informationIntroduction to Routing and Packet Forwarding. Routing Protocols and Concepts Chapter 1
Introduction to Routing and Packet Forwarding Routing Protocols and Concepts Chapter 1 1 1 Objectives Identify a router as a computer with an OS and hardware designed for the routing process. Demonstrate
More informationCisco Configuring Basic MPLS Using OSPF
Table of Contents Configuring Basic MPLS Using OSPF...1 Introduction...1 Mechanism...1 Hardware and Software Versions...2 Network Diagram...2 Configurations...2 Quick Configuration Guide...2 Configuration
More informationMPLS VPN over mgre. Finding Feature Information. Prerequisites for MPLS VPN over mgre
The feature overcomes the requirement that a carrier support multiprotocol label switching (MPLS) by allowing you to provide MPLS connectivity between networks that are connected by IP-only networks. This
More informationIntegrated Traffic Monitoring
61202880L1-29.1E July 2008 Configuration Guide This configuration guide describes integrated traffic monitoring (ITM) and its use on ADTRAN Operating System (AOS) products. Including an overview of the
More informationEthernet. Ethernet. Network Devices
Ethernet Babak Kia Adjunct Professor Boston University College of Engineering ENG SC757 - Advanced Microprocessor Design Ethernet Ethernet is a term used to refer to a diverse set of frame based networking
More informationLecture Computer Networks
Prof. Dr. H. P. Großmann mit M. Rabel sowie H. Hutschenreiter und T. Nau Sommersemester 2012 Institut für Organisation und Management von Informationssystemen Thomas Nau, kiz Lecture Computer Networks
More informationConfiguring NetFlow. Information About NetFlow. Send document comments to nexus1k-docfeedback@cisco.com. CHAPTER
CHAPTER 11 Use this chapter to configure NetFlow to characterize IP traffic based on its source, destination, timing, and application information, to assess network availability and performance. This chapter
More informationCisco Performance Monitor Commands
1 action (policy react and policy inline react) Cisco Performance Monitor Commands action (policy react and policy inline react) To configure which applications which will receive an alarm or notification,
More informationNetFlow Tracker Overview. Mike McGrath x ccie CTO mike@crannog-software.com
NetFlow Tracker Overview Mike McGrath x ccie CTO mike@crannog-software.com 2006 Copyright Crannog Software www.crannog-software.com 1 Copyright Crannog Software www.crannog-software.com 2 LEVELS OF NETWORK
More information8.2 The Internet Protocol
TCP/IP Protocol Suite HTTP SMTP DNS RTP Distributed applications Reliable stream service TCP UDP User datagram service Best-effort connectionless packet transfer Network Interface 1 IP Network Interface
More informationChapter 3. TCP/IP Networks. 3.1 Internet Protocol version 4 (IPv4)
Chapter 3 TCP/IP Networks 3.1 Internet Protocol version 4 (IPv4) Internet Protocol version 4 is the fourth iteration of the Internet Protocol (IP) and it is the first version of the protocol to be widely
More informationNetFlow: what happens in your network?
NetFlow: what happens in your network? by Lorenzo Busatti MUM Ljubljana 2016 Lorenzo Busatti, http://routing.wireless.academy 1 About me Lorenzo Busatti Founder of Grifonline S.r.l. (1997) Founder of Linkwave
More informationHow-To Configure NetFlow v5 & v9 on Cisco Routers
How-To Configure NetFlow v5 & v9 on Cisco Routers Share: Visibility into the network is an indispensable tool for network administrators. Network visibility can be achieved through daily troubleshooting,
More informationIP Addressing A Simplified Tutorial
Application Note IP Addressing A Simplified Tutorial July 2002 COMPAS ID 92962 Avaya Labs 1 All information in this document is subject to change without notice. Although the information is believed to
More informationTechnical Support Information Belkin internal use only
The fundamentals of TCP/IP networking TCP/IP (Transmission Control Protocol / Internet Protocols) is a set of networking protocols that is used for communication on the Internet and on many other networks.
More informationIP Addressing Introductory material.
IP Addressing Introductory material. A module devoted to IP addresses. Addresses & Names Hardware (Layer 2) Lowest level Ethernet (MAC), Serial point-to-point,.. Network (Layer 3) IP IPX, SNA, others Transport
More informationGuide to TCP/IP, Third Edition. Chapter 3: Data Link and Network Layer TCP/IP Protocols
Guide to TCP/IP, Third Edition Chapter 3: Data Link and Network Layer TCP/IP Protocols Objectives Understand the role that data link protocols, such as SLIP and PPP, play for TCP/IP Distinguish among various
More informationIP Accounting C H A P T E R
C H A P T E R 6 IP Accounting This chapter describes the IP Accounting features in Cisco IOS and enables you to distinguish the different IP Accounting functions and understand SNMP MIB details. This chapter
More informationJ-Flow on J Series Services Routers and Branch SRX Series Services Gateways
APPLICATION NOTE Juniper Flow Monitoring J-Flow on J Series Services Routers and Branch SRX Series Services Gateways Copyright 2011, Juniper Networks, Inc. 1 APPLICATION NOTE - Juniper Flow Monitoring
More informationHow To Use Netflow On Cisco Ios V2.3.4.4 (V2.4) And V2 (V3.3) (V1.4).4.2.2) (Cisco V
NetFlow Services and Applications Whitepaper Kevin Delgadillo, Cisco IOS Product Marketing Table of Contents 1.0 Introduction 2.0 NetFlow Definitions and Benefits 2.1 NetFlow Cache Management and Data
More informationIPv6 network management. Where and when?
IPv6 network management 1 Contributions Simon Muyal, RENATER Bernard Tuy, RENATER Jérôme Durand, RENATER Ralf Wolter, Cisco Patrick Grossetête, Cisco Munechika Sumikawa, Hitachi Patrick Paul, 6WIND 2 Agenda
More informationConfiguring Denial of Service Protection
24 CHAPTER This chapter contains information on how to protect your system against Denial of Service (DoS) attacks. The information covered in this chapter is unique to the Catalyst 6500 series switches,
More informationChapter 11 Network Address Translation
Chapter 11 Network Address Translation You can configure an HP routing switch to perform standard Network Address Translation (NAT). NAT enables private IP networks that use nonregistered IP addresses
More informationBorder Gateway Protocol (BGP)
Border Gateway Protocol (BGP) Petr Grygárek rek 1 Role of Autonomous Systems on the Internet 2 Autonomous systems Not possible to maintain complete Internet topology information on all routers big database,
More information13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) 13.2 Layer 2/3/4 VPNs 13.3 Multi-Protocol Label Switching 13.4 IPsec Transport Mode
13 Virtual Private Networks 13.1 Point-to-Point Protocol (PPP) PPP-based remote access using dial-in PPP encryption control protocol (ECP) PPP extensible authentication protocol (EAP) 13.2 Layer 2/3/4
More informationVanguard Applications Ware IP and LAN Feature Protocols. Firewall
Vanguard Applications Ware IP and LAN Feature Protocols Firewall Notice 2008 Vanguard Networks. 25 Forbes Boulevard Foxboro, Massachusetts 02035 Phone: (508) 964-6200 Fax: 508-543-0237 All rights reserved
More informationCourse Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
More informationand reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs
ICmyNet.Flow: NetFlow based traffic investigation, analysis, and reporting Slavko Gajin slavko.gajin@rcub.bg.ac.rs AMRES Academic Network of Serbia RCUB - Belgrade University Computer Center ETF Faculty
More informationIPv6 network management. 6DEPLOY. IPv6 Deployment and Support
IPv6 network management 6DEPLOY. IPv6 Deployment and Support 1 Contributions Simon Muyal, RENATER Bernard Tuy, RENATER Jérôme Durand, RENATER Ralf Wolter, Cisco Patrick Grossetête, Cisco 10/28/2010 IPv6
More informationIP Filter/Firewall Setup
IP Filter/Firewall Setup Introduction The IP Filter/Firewall function helps protect your local network against attack from outside. It also provides a method of restricting users on the local network from
More informationConfiguring NetFlow Secure Event Logging (NSEL)
75 CHAPTER This chapter describes how to configure NSEL, a security logging mechanism that is built on NetFlow Version 9 technology, and how to handle events and syslog messages through NSEL. The chapter
More informationConfiguring NetFlow and NetFlow Data Export
This module contains information about and instructions for configuring NetFlow to capture and export network traffic data. NetFlow capture and export are performed independently on each internetworking
More informationNetFlow probe on NetFPGA
Verze #1.00, 2008-12-12 NetFlow probe on NetFPGA Introduction With ever-growing volume of data being transferred over the Internet, the need for reliable monitoring becomes more urgent. Monitoring devices
More informationNetFlow Performance Analysis
NetFlow Performance Analysis Last Updated: May, 2007 The Cisco IOS NetFlow feature set allows for the tracking of individual IP flows as they are received at a Cisco router or switching device. Network
More informationSavera Tanwir. Internet Protocol
Savera Tanwir Internet Protocol The IP Protocol The IPv4 (Internet Protocol) header. IP Packet Details Header and payload Header itself has a fixed part and variable part Version IPv4, IPv5 or IPv6 IHL,
More informationAPPLICATION NOTE 211 MPLS BASICS AND TESTING NEEDS. Label Switching vs. Traditional Routing
MPLS BASICS AND TESTING NEEDS By Thierno Diallo, Product Specialist Protocol Business Unit The continuing expansion and popularity of the Internet is forcing routers in the core network to support the
More informationIntroduction to ISIS. ISP/IXP Workshops
Introduction to ISIS ISP/IXP Workshops 1 IS-IS Standards History ISO 10589 specifies OSI IS-IS routing protocol for CLNS traffic A Link State protocol with a 2 level hierarchical architecture Type/Length/Value
More informationHOST AUTO CONFIGURATION (BOOTP, DHCP)
Announcements HOST AUTO CONFIGURATION (BOOTP, DHCP) I. HW5 online today, due in week! Internet Protocols CSC / ECE 573 Fall, 2005 N. C. State University copyright 2005 Douglas S. Reeves 2 I. Auto configuration
More informationNetFlow The De Facto Standard for Traffic Analytics
NetFlow The De Facto Standard for Traffic Analytics A Webinar on NetFlow and its uses in Enterprise Networks for Bandwidth and Traffic Analytics Don Thomas Jacob Technical Marketing Engineer ManageEngine
More informationIntroduction to Netflow
Introduction to Netflow Mike Jager Network Startup Resource Center mike.jager@synack.co.nz These materials are licensed under the Creative Commons Attribution-NonCommercial 4.0 International license (http://creativecommons.org/licenses/by-nc/4.0/)
More informationRARP: Reverse Address Resolution Protocol
SFWR 4C03: Computer Networks and Computer Security January 19-22 2004 Lecturer: Kartik Krishnan Lectures 7-9 RARP: Reverse Address Resolution Protocol When a system with a local disk is bootstrapped it
More informationRecommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document
Recommendations for Network Traffic Analysis Using the NetFlow Protocol Best Practice Document Produced by AMRES NMS Group (AMRES BPD 104) Author: Ivan Ivanović November 2011 TERENA 2010. All rights reserved.
More informationNetwork Monitoring and Management NetFlow Overview
Network Monitoring and Management NetFlow Overview These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/)
More informationLAB II: Securing The Data Path and Routing Infrastructure
LAB II: Securing The Data Path and Routing Infrastructure 8. Create Packet Filters a. Create a packet filter which will deny packets that have obviously bogus IP source addresses but permit everything
More informationTable of Contents. Cisco Configuring a Basic MPLS VPN
Table of Contents Configuring a Basic MPLS VPN...1 Introduction...1 Prerequisites...1 Requirements...1 Components Used...2 Related Products...2 Conventions...2 Configure...3 Network Diagram...3 Configuration
More informationSubnetting,Supernetting, VLSM & CIDR
Subnetting,Supernetting, VLSM & CIDR WHAT - IP Address Unique 32 or 128 bit Binary, used to identify a system on a Network or Internet. Network Portion Host Portion CLASSFULL ADDRESSING IP address space
More informationTransport and Network Layer
Transport and Network Layer 1 Introduction Responsible for moving messages from end-to-end in a network Closely tied together TCP/IP: most commonly used protocol o Used in Internet o Compatible with a
More informationRFC 2547bis: BGP/MPLS VPN Fundamentals
White Paper RFC 2547bis: BGP/MPLS VPN Fundamentals Chuck Semeria Marketing Engineer Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA 94089 USA 408 745 2001 or 888 JUNIPER www.juniper.net
More informationVLAN und MPLS, Firewall und NAT,
Internet-Technologien (CS262) VLAN und MPLS, Firewall und NAT, 15.4.2015 Christian Tschudin Departement Mathematik und Informatik, Universität Basel 6-1 Wiederholung Unterschied CSMA/CD und CSMA/CA? Was
More informationIP Routing Features. Contents
7 IP Routing Features Contents Overview of IP Routing.......................................... 7-3 IP Interfaces................................................ 7-3 IP Tables and Caches........................................
More informationNetFlow Services and Applications
WHITE PAPER NetFlow Services and Applications Introduction Rapid growth in Internet and intranet deployment and usage has created a major shift in both corporate and consumer computing paradigms. This
More informationIP - The Internet Protocol
Orientation IP - The Internet Protocol IP (Internet Protocol) is a Network Layer Protocol. IP s current version is Version 4 (IPv4). It is specified in RFC 891. TCP UDP Transport Layer ICMP IP IGMP Network
More informationCS 457 Lecture 19 Global Internet - BGP. Fall 2011
CS 457 Lecture 19 Global Internet - BGP Fall 2011 Decision Process Calculate degree of preference for each route in Adj-RIB-In as follows (apply following steps until one route is left): select route with
More informationLayer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers
Layer Four Traceroute (and related tools) A modern, flexible path-discovery solution with advanced features for network (reverse) engineers So, what is path discovery and why is it important? Path discovery
More informationUnderstanding and Configuring NAT Tech Note PAN-OS 4.1
Understanding and Configuring NAT Tech Note PAN-OS 4.1 Revision C 2012, Palo Alto Networks, Inc. www.paloaltonetworks.com Contents Overview... 3 Scope... 3 Design Consideration... 3 Software requirement...
More information